morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3902] [MERGED] fix(mcp): declare Frida status session mutation #5960

New issue

Closed

opened 2026-10-31 01:10:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:10:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3902
Author: @z2Ace0107
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/16/2026
Merged by: @morluto

Base: main ← Head: fix/3326-frida-status-effects

📝 Commits (2)

0f437bb fix(mcp): declare Frida status session mutation
7d7e8fe style(test): format hook-normalized cancellation options

📊 Changes

2 files changed (+81 additions, -5 deletions)

View changed files

📝 src/contracts/toolEffects.ts (+1 -1)
📝 tests/boundary/mcp/fridaLifecycleMcp.test.ts (+80 -4)

📄 Description

Summary

Fixes #3326. Match Frida status effect metadata to its existing Evidence recording.

 frida_session_status
- readOnlyHint: true,  mutatesSession: false
+ readOnlyHint: false, mutatesSession: true
  destructiveHint: false

Problem and expected behavior

Successful status queries retain Evidence, but the catalog advertised them as
read-only. REA's read-only definition includes session state. Ordinary additive
Evidence recording should remain non-destructive.

Change and scope

Reuse the existing evidence effect declaration in toolEffects.ts. Extend the
existing MCP lifecycle regression; no handler, Frida engine, target behavior,
runtime permission, or lifecycle change. Advance maintainer scope decision is not
applicable to this ordinary metadata correction.

Contract and boundary impact

Semantic owner: canonical tool effects, before annotation/inventory projection.
CLI/MCP: correct tools/list and binary_session metadata; input/output shapes
and the one-shot CLI are unchanged.
Provider/platform: unchanged; no new native Frida compatibility claim.
Evidence: status output and retained Evidence remain unchanged.
Target selection, execution/mutation authority and cleanup: unchanged.
Generated metadata: catalog projections regenerated/checked locally; ignored
generated outputs are not included. No version, package or installation edit.

Expected effect of the corrected status operation: additive in-memory session
Evidence recording. It does not introduce target execution, instrumentation,
target/file/configuration mutation, network access, or protection recovery.

Evidence and regression coverage

Before: on baseline 788964d52, the new MCP regression failed at
readOnlyHint: true versus expected false (1 failed / 25 passed).
After: the status response is schema-valid and retained unchanged;
tools/list advertises non-read-only/non-destructive behavior and binary_session
declares mutatesSession. An unknown session adds no Evidence.
Production manager/server/ledger, with a simulated external Frida device on
Windows. This proves the metadata/retention boundary, not real-engine behavior.

Validation performed

Windows x64; pinned Node 24.18.0 / npm 11.16.0:

npm ci — passed; 0 vulnerabilities reported.
npm run test:focused -- src/contracts/toolEffects.test.ts src/contracts/fridaToolContracts.test.ts tests/boundary/mcp/fridaMcp.test.ts tests/boundary/mcp/fridaLifecycleMcp.test.ts
— 40 passed, 0 skipped.
npm run check — passed, including build dependencies, typecheck, lint,
format, knip, metadata, module boundaries and architecture guards. Warnings remain.
npm run docs:check — passed, including catalog generation/checks and 5 README
consistency tests.
git diff --check — passed.
Compiled production stdio MCP — tools/list reports readOnlyHint false and
destructiveHint false; binary_session advertises mutatesSession, without an
injected provider. No real Frida target was selected or executed.

Compatibility, safety, and release

No payload/schema-shape change or migration. MCP clients may now seek confirmation
for this correctly classified operation, depending on their own policies.
No real Frida/device lane or full-suite run; native implementation is unchanged.

Merge Danger

Door: two-way. Blast radius: narrow — one tool's effect classification and the
derived catalog identity; no persistent-data migration or native behavior change.

Author readiness

Human owner: @z2Ace0107

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3902 **Author:** [@z2Ace0107](https://github.com/z2Ace0107) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/16/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/3326-frida-status-effects` --- ### 📝 Commits (2) - [`0f437bb`](https://github.com/morluto/rea/commit/0f437bba262acfe45b9e6c2432f73f155c76156a) fix(mcp): declare Frida status session mutation - [`7d7e8fe`](https://github.com/morluto/rea/commit/7d7e8fe34e01e3a41848d0eb0a9d876c8101a799) style(test): format hook-normalized cancellation options ### 📊 Changes **2 files changed** (+81 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `src/contracts/toolEffects.ts` (+1 -1) 📝 `tests/boundary/mcp/fridaLifecycleMcp.test.ts` (+80 -4) </details> ### 📄 Description ## Summary Fixes #3326. Match Frida status effect metadata to its existing Evidence recording. ```diff frida_session_status - readOnlyHint: true, mutatesSession: false + readOnlyHint: false, mutatesSession: true destructiveHint: false ``` ## Problem and expected behavior Successful status queries retain Evidence, but the catalog advertised them as read-only. REA's read-only definition includes session state. Ordinary additive Evidence recording should remain non-destructive. ## Change and scope Reuse the existing `evidence` effect declaration in `toolEffects.ts`. Extend the existing MCP lifecycle regression; no handler, Frida engine, target behavior, runtime permission, or lifecycle change. Advance maintainer scope decision is not applicable to this ordinary metadata correction. ## Contract and boundary impact - Semantic owner: canonical tool effects, before annotation/inventory projection. - CLI/MCP: correct tools/list and binary_session metadata; input/output shapes and the one-shot CLI are unchanged. - Provider/platform: unchanged; no new native Frida compatibility claim. - Evidence: status output and retained Evidence remain unchanged. - Target selection, execution/mutation authority and cleanup: unchanged. - Generated metadata: catalog projections regenerated/checked locally; ignored generated outputs are not included. No version, package or installation edit. Expected effect of the corrected status operation: additive in-memory session Evidence recording. It does not introduce target execution, instrumentation, target/file/configuration mutation, network access, or protection recovery. ## Evidence and regression coverage - Before: on baseline `788964d52`, the new MCP regression failed at `readOnlyHint: true` versus expected false (1 failed / 25 passed). - After: the status response is schema-valid and retained unchanged; tools/list advertises non-read-only/non-destructive behavior and binary_session declares mutatesSession. An unknown session adds no Evidence. - Production manager/server/ledger, with a simulated external Frida device on Windows. This proves the metadata/retention boundary, not real-engine behavior. ## Validation performed Windows x64; pinned Node 24.18.0 / npm 11.16.0: - `npm ci` — passed; 0 vulnerabilities reported. - `npm run test:focused -- src/contracts/toolEffects.test.ts src/contracts/fridaToolContracts.test.ts tests/boundary/mcp/fridaMcp.test.ts tests/boundary/mcp/fridaLifecycleMcp.test.ts` — 40 passed, 0 skipped. - `npm run check` — passed, including build dependencies, typecheck, lint, format, knip, metadata, module boundaries and architecture guards. Warnings remain. - `npm run docs:check` — passed, including catalog generation/checks and 5 README consistency tests. - `git diff --check` — passed. - Compiled production stdio MCP — tools/list reports readOnlyHint false and destructiveHint false; binary_session advertises mutatesSession, without an injected provider. No real Frida target was selected or executed. ## Compatibility, safety, and release No payload/schema-shape change or migration. MCP clients may now seek confirmation for this correctly classified operation, depending on their own policies. No real Frida/device lane or full-suite run; native implementation is unchanged. ## Merge Danger Door: two-way. Blast radius: narrow — one tool's effect classification and the derived catalog identity; no persistent-data migration or native behavior change. ## Author readiness Human owner: @z2Ace0107 - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:10:44 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:52 +00:00

[PR #6151] [CLOSED] fix(cancellation): preserve the caller abort reason #7168

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5960

No description provided.

Rows
Columns