morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7812] fix(pcap): exclude HTTP credentials from failed command observations #4648

New issue

Closed

opened 2026-10-31 00:51:53 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:51:53 +00:00

Owner

Originally created by @gensokyo-dev on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7812

Before submitting

I searched open and closed issues for related reports.
This report contains no credentials or sensitive target data.

Area

Packet-capture analysis / error Evidence

Observed behavior

Source-derived finding, subsequently reproduced, at 6c895eeb8: successful inspect_pcap_capture projections exclude HTTP URL userinfo through parseRecordedTransportUrl, while runPcapCommand copies raw producer stdout into capturedOutput on output-limit, cancellation and other failures. Retained cleanup diagnostics can copy the same raw stream. That creates a bypass of the capture-summary credential contract in returned or retained error observations.

Reproduction

Executed on the reported revision with pinned Node 24.22.1 and real TShark/capinfos 4.0.17. An owned generated offline Ethernet/IPv4/TCP HTTP capture contains a synthetic URL credential, with no live traffic. A 224-byte capture plus a 585-byte command-output allowance reproduced disclosure in the typed resource error.

The public CLI was independently reproduced with a 40,000-packet, 8,000,024-byte capture (SHA-256 edd937b248aeee039f0f8a1963955210ae055b232ef61cae5b35cc3dacc53d40). The command returned resource_constraint/exit 1 and retained 8,388,608 raw stdout bytes; its 9,547,033-byte error JSON disclosed the synthetic value. Completed baseline task: 10.095 s elapsed, 9.967 s CPU, 481.9 MiB sampled process-family RSS, on two CPUs.

The working fix passes the same CLI workload, direct MCP errors, default-budget retained errors and exported bundles without the value. Fix PR: #7871. Current head 79ce9851a passes 227 tests across 10 files (3 skipped), including real CLI/MCP and six command-level success/failure/cancellation/cleanup-retry/native regressions. Static and documentation checks passed. Codex found no issue and Greptile rated this exact commit 5/5; Actions runners are currently queued. Native Windows and real HTTP/2 traffic remain unverified.

Expected behavior

Apply the same transport-credential semantics to successful results, failed-command diagnostics and retained/exported errors. Preserve caller-selected paths and other URI bytes, original byte/truncation facts, failure classification and resource ownership. Keep CLI/MCP on the shared producer and bound projection work/memory; incomplete producer text must remain explicitly partial/unknown.

REA version

Main revision 6c895eeb8e6b26bac1d551fc6660ee075a76fd6b, package 6.8.0.

Runtime and platform

Linux x64, pinned Node 24.22.1; installed TShark/capinfos 4.0.17. Native Windows behavior is not yet established.

Target and artifact context

Executed with an owned generated offline HTTP capture; no external traffic or real credential.

Interface / earliest failure stage

Shared packet-tool command failure/cleanup projection before CLI/MCP error retention.

Relevant output or evidence

Raw command output enters failure/cleanup observations.
Successful HTTP fields use the shared URL interpretation.
Executed evidence: real TShark command-level regression, public CLI baseline, and self-contained native CLI/MCP/retained-export regressions above. No real credential was used.

Additional context

Ordinary privacy repair within existing offline capture analysis; no new target execution or capture authority. Preserve raw selected-field tools' documented caller-selected data semantics.

Originally created by @gensokyo-dev on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7812 ### Before submitting - [x] I searched open and closed issues for related reports. - [x] This report contains no credentials or sensitive target data. ### Area Packet-capture analysis / error Evidence ### Observed behavior Source-derived finding, subsequently reproduced, at `6c895eeb8`: successful `inspect_pcap_capture` projections exclude HTTP URL userinfo through `parseRecordedTransportUrl`, while `runPcapCommand` copies raw producer stdout into `capturedOutput` on output-limit, cancellation and other failures. Retained cleanup diagnostics can copy the same raw stream. That creates a bypass of the capture-summary credential contract in returned or retained error observations. ### Reproduction Executed on the reported revision with pinned Node 24.22.1 and real TShark/capinfos 4.0.17. An owned generated offline Ethernet/IPv4/TCP HTTP capture contains a synthetic URL credential, with no live traffic. A 224-byte capture plus a 585-byte command-output allowance reproduced disclosure in the typed resource error. The public CLI was independently reproduced with a 40,000-packet, 8,000,024-byte capture (SHA-256 edd937b248aeee039f0f8a1963955210ae055b232ef61cae5b35cc3dacc53d40). The command returned resource_constraint/exit 1 and retained 8,388,608 raw stdout bytes; its 9,547,033-byte error JSON disclosed the synthetic value. Completed baseline task: 10.095 s elapsed, 9.967 s CPU, 481.9 MiB sampled process-family RSS, on two CPUs. The working fix passes the same CLI workload, direct MCP errors, default-budget retained errors and exported bundles without the value. Fix PR: #7871. Current head `79ce9851a` passes 227 tests across 10 files (3 skipped), including real CLI/MCP and six command-level success/failure/cancellation/cleanup-retry/native regressions. Static and documentation checks passed. Codex found no issue and Greptile rated this exact commit 5/5; Actions runners are currently queued. Native Windows and real HTTP/2 traffic remain unverified. ### Expected behavior Apply the same transport-credential semantics to successful results, failed-command diagnostics and retained/exported errors. Preserve caller-selected paths and other URI bytes, original byte/truncation facts, failure classification and resource ownership. Keep CLI/MCP on the shared producer and bound projection work/memory; incomplete producer text must remain explicitly partial/unknown. ### REA version Main revision `6c895eeb8e6b26bac1d551fc6660ee075a76fd6b`, package 6.8.0. ### Runtime and platform Linux x64, pinned Node 24.22.1; installed TShark/capinfos 4.0.17. Native Windows behavior is not yet established. ### Target and artifact context Executed with an owned generated offline HTTP capture; no external traffic or real credential. ### Interface / earliest failure stage Shared packet-tool command failure/cleanup projection before CLI/MCP error retention. ### Relevant output or evidence - [Raw command output enters failure/cleanup observations](https://github.com/morluto/rea/blob/6c895eeb8e6b26bac1d551fc6660ee075a76fd6b/src/pcap/PcapCommand.ts#L137). - [Successful HTTP fields use the shared URL interpretation](https://github.com/morluto/rea/blob/6c895eeb8e6b26bac1d551fc6660ee075a76fd6b/src/pcap/PcapOutput.ts#L525). - Executed evidence: real TShark command-level regression, public CLI baseline, and self-contained native CLI/MCP/retained-export regressions above. No real credential was used. ### Additional context Ordinary privacy repair within existing offline capture analysis; no new target execution or capture authority. Preserve raw selected-field tools' documented caller-selected data semantics.

bsakaguchi

2026-10-31 00:51:53 +00:00

closed this issue
added the
bug

triage
labels

bsakaguchi referenced this issue

2026-10-31 01:13:43 +00:00

[PR #4648] [CLOSED] fix(mcp): retain same-address procedure aliases in completion #6341

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4648

No description provided.

Rows
Columns