[PR #2644] [CLOSED] fix(hopper): distinguish runtime processes from argument text #5304

New issue

Closed

opened 2026-10-31 01:05:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2644
Author: @N0zoM1z0
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: fix/hopper-clean-runtime-argv

📝 Commits (10+)

a588dc6 fix(hopper): distinguish runtime processes from argument text
2ac4795 test(hopper): cover a reparented Python helper command
3deda47 fix(hopper): parse Python helper interpreter options
3bb09b8 fix(verification): retain command-less runtime observations
51b3418 chore: merge upstream CI baseline fixes
b2e743e test(hopper): reap orphan fixtures independently of container init
2bc898f chore: merge captured main into Hopper runtime cleanup
dd401a2 test(process): isolate hopper inventory proc root
3f18439 fix(types): declare hopper inventory proc root
1738989 test: isolate hopper scanner process fixtures

📄 Description

The Linux Hopper cleanup verifier mistakes runtime names in ordinary command arguments for surviving processes. Replacing rendered ps text matching with procfs arguments fixes those false positives, while retaining detection of reparented helpers, alternate launcher identities and unreaped runtime processes.

Read /proc/<pid>/cmdline once and recognize CPython's actual script operand, including interpreter options and --; forwarded names in -c/-m arguments remain ordinary arguments. If argv is gone, read the kernel command name: Hopper/Xvfb remnants block the lane, and an unidentified Python interpreter remains unknown. Preserve device/inode launcher identity, deferred caller-process inspection failures and observation without signaling. Shared process tests run in the existing serial boundary lane.

This follows merged #2638 and changes verification only. Production tool contracts, Evidence and agent payloads are unchanged.

Full native verification on a70d6376abdeb5ce86e327e24bb31754c0f124a0, based on main 11f1d952e:

Twenty focused tests and typecheck/lint pass. Real before/after probes reproduce both argument-text false positives and the missed Xvfb zombie. Real reparented Python cases cover option grammar and command/module forwarding; unreaped-child cases cover Hopper, Xvfb, Python uncertainty and an unrelated process. Detection neither signals nor reaps; the waiting fixture parent performs cleanup.
A fresh Ubuntu 24.04 x64 container, empty HOME and approved official Hopper 6.4.2 demo installation pass setup planning, scoped doctor, CLI/MCP conformance, zero-action repeated setup, modified-launcher rejection and clean teardown. All 3,301 source hashes are unchanged before/after.
Native verification covers 191 schemas, 180 successful and 63 rejected boundary calls, 1,205-item inventories, cancellation/deadline recovery, and graceful/SIGKILL owner exits with same/different-target reuse. The unrelated-process sentinel is Node titled Hopper; a second simultaneous real demo GUI is not claimed.
Full native/setup execution: 115.30 s wall, 138.40 s dedicated-container CPU, 1.78 GiB sampled summed RSS peak. Fixtures/runtime were built beforehand; installation and HOME were fresh. RSS is a 50 ms sample sum with shared pages counted per process, not PSS.
Thirty alternating warm clean-runner observer trials: median 6.54 -> 1.79 ms, p95 8.33 -> 2.44 ms against the original ps observer. No extra child process or persistent process-state cache. This measures verifier overhead, not analysis speed or agent tokens.

Real-provider scope excludes macOS, other Hopper builds, saved-database persistence and synchronous native interruption. Raw long/Unicode bytes are verified independently; native decoded objects absent from the demo remain explicitly unverified.

Current head b2e743ef2461fc3ed8212ef0830a4494add91ed4 retains the maintainer's merge of upstream CI baseline fixes (51b3418f2). The observer and declaration bytes remain identical to the fully native-verified head above. The latest review found a fixture ownership gap on containers whose PID 1 does not reap adopted children. The fixtures now retain their own Linux subreaper through token-verified group cleanup, then wait for each adopted child and assert procfs disappearance. A separate verifier still proves that these children are outside its own lineage; no observer mutation authority was added.

The exact preceding head reproduces two failed negative cases and eight residual zombies in an Ubuntu 24.04 container deliberately running without --init. The corrected fourteen process cases pass in the same environment, with no residual children. The twenty related checks pass on the host; final fixture refactoring is verified by the no-init run, typecheck and lint. This revision changes only the test fixture; the full real-provider scope and performance measurements above retain their stated source binding. All five implementation/test commits retain the requested GitHub co-author trailer, which will also be preserved in the squash commit.

CI and automated reviews are running on this updated head. The formerly blocking dyld fixture was fixed upstream in #2755 and is present through the maintainer merge; no unrelated baseline correction is included in this PR.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2644 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/hopper-clean-runtime-argv` --- ### 📝 Commits (10+) - [`a588dc6`](https://github.com/morluto/rea/commit/a588dc6376b7dbf6e5588fae51b371dafed8fb5d) fix(hopper): distinguish runtime processes from argument text - [`2ac4795`](https://github.com/morluto/rea/commit/2ac4795df59217f2d95dc93599fdd1e562597979) test(hopper): cover a reparented Python helper command - [`3deda47`](https://github.com/morluto/rea/commit/3deda4781d639d8b382eb9d0062304265fb1a588) fix(hopper): parse Python helper interpreter options - [`3bb09b8`](https://github.com/morluto/rea/commit/3bb09b8d2d976d0d0172901e166ce9afd1ddcaf1) fix(verification): retain command-less runtime observations - [`51b3418`](https://github.com/morluto/rea/commit/51b3418f2b83ed44776730e49d797e4a0dbad5d5) chore: merge upstream CI baseline fixes - [`b2e743e`](https://github.com/morluto/rea/commit/b2e743ef2461fc3ed8212ef0830a4494add91ed4) test(hopper): reap orphan fixtures independently of container init - [`2bc898f`](https://github.com/morluto/rea/commit/2bc898fae21295466666298b6d1c842f11a2d789) chore: merge captured main into Hopper runtime cleanup - [`dd401a2`](https://github.com/morluto/rea/commit/dd401a2804a41990e8bf815a0b7fae51ff528493) test(process): isolate hopper inventory proc root - [`3f18439`](https://github.com/morluto/rea/commit/3f18439acd780d13bae0de507b69061958c827ab) fix(types): declare hopper inventory proc root - [`1738989`](https://github.com/morluto/rea/commit/17389895903f3a7982872c9401b7f76485906561) test: isolate hopper scanner process fixtures ### 📄 Description The Linux Hopper cleanup verifier mistakes runtime names in ordinary command arguments for surviving processes. Replacing rendered `ps` text matching with procfs arguments fixes those false positives, while retaining detection of reparented helpers, alternate launcher identities and unreaped runtime processes. Read `/proc/<pid>/cmdline` once and recognize CPython's actual script operand, including interpreter options and `--`; forwarded names in `-c`/`-m` arguments remain ordinary arguments. If argv is gone, read the kernel command name: Hopper/Xvfb remnants block the lane, and an unidentified Python interpreter remains unknown. Preserve device/inode launcher identity, deferred caller-process inspection failures and observation without signaling. Shared process tests run in the existing serial boundary lane. This follows merged #2638 and changes verification only. Production tool contracts, Evidence and agent payloads are unchanged. Full native verification on `a70d6376abdeb5ce86e327e24bb31754c0f124a0`, based on main `11f1d952e`: - Twenty focused tests and typecheck/lint pass. Real before/after probes reproduce both argument-text false positives and the missed Xvfb zombie. Real reparented Python cases cover option grammar and command/module forwarding; unreaped-child cases cover Hopper, Xvfb, Python uncertainty and an unrelated process. Detection neither signals nor reaps; the waiting fixture parent performs cleanup. - A fresh Ubuntu 24.04 x64 container, empty HOME and approved official Hopper 6.4.2 demo installation pass setup planning, scoped doctor, CLI/MCP conformance, zero-action repeated setup, modified-launcher rejection and clean teardown. All 3,301 source hashes are unchanged before/after. - Native verification covers 191 schemas, 180 successful and 63 rejected boundary calls, 1,205-item inventories, cancellation/deadline recovery, and graceful/SIGKILL owner exits with same/different-target reuse. The unrelated-process sentinel is Node titled Hopper; a second simultaneous real demo GUI is not claimed. - Full native/setup execution: 115.30 s wall, 138.40 s dedicated-container CPU, 1.78 GiB sampled summed RSS peak. Fixtures/runtime were built beforehand; installation and HOME were fresh. RSS is a 50 ms sample sum with shared pages counted per process, not PSS. - Thirty alternating warm clean-runner observer trials: median 6.54 -> 1.79 ms, p95 8.33 -> 2.44 ms against the original `ps` observer. No extra child process or persistent process-state cache. This measures verifier overhead, not analysis speed or agent tokens. Real-provider scope excludes macOS, other Hopper builds, saved-database persistence and synchronous native interruption. Raw long/Unicode bytes are verified independently; native decoded objects absent from the demo remain explicitly unverified. Current head `b2e743ef2461fc3ed8212ef0830a4494add91ed4` retains the maintainer's merge of upstream CI baseline fixes (`51b3418f2`). The observer and declaration bytes remain identical to the fully native-verified head above. The latest review found a fixture ownership gap on containers whose PID 1 does not reap adopted children. The fixtures now retain their own Linux subreaper through token-verified group cleanup, then wait for each adopted child and assert procfs disappearance. A separate verifier still proves that these children are outside its own lineage; no observer mutation authority was added. The exact preceding head reproduces two failed negative cases and eight residual zombies in an Ubuntu 24.04 container deliberately running without `--init`. The corrected fourteen process cases pass in the same environment, with no residual children. The twenty related checks pass on the host; final fixture refactoring is verified by the no-init run, typecheck and lint. This revision changes only the test fixture; the full real-provider scope and performance measurements above retain their stated source binding. All five implementation/test commits retain the requested GitHub co-author trailer, which will also be preserved in the squash commit. CI and automated reviews are running on this updated head. The formerly blocking dyld fixture was fixed upstream in #2755 and is present through the maintainer merge; no unrelated baseline correction is included in this PR. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:35 +00:00