[GH-ISSUE #2376] [Design] Observe caller-selected JVM debugger sessions through JDI/JDWP #787

Open
opened 2026-10-15 18:28:21 +00:00 by bsakaguchi · 2 comments
Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2376

Type: Architecture / RFC Status: Proposed Ecosystem: REA

Analyst question

For an explicitly selected JVM, which class-loader-qualified method and source location was stopped, and what do its threads, frames and available locals show?

#1558 covers static Java class analysis. #1267 defines general debugger lifecycle concerns. Neither defines JVM class-loader identity, JDI event suspension or JDWP reference lifetimes.

Proposed first lane

Use a caller-installed JDK/JDI helper to connect to one caller-selected local, already-enabled JDWP endpoint. Verify and retain the available VM/process identity; an endpoint or Java version alone does not prove association with a selected JAR. Discovery must not launch targets, scan ports or enable debugging implicitly.

  • Select methods by defining class-loader identity, class name and descriptor; preserve overloaded and duplicate-loader classes.
  • Observe selected line/method/exception events and bounded threads, frames, primitive locals and raw fields.
  • Distinguish absent line/local tables, pending classes, optimized/unavailable values, collected objects and disconnected VMs.
  • Retain actual EventSet suspension policy and balance only suspensions owned by this session. Frames expire when their thread resumes.
  • Render values without toString, getters, expression evaluation, method invocation, class redefinition or field writes. Reading and debugger attachment still have effects and must be declared.
  • Treat managed locations as VM coordinates, not native addresses or proof that bytes match a static artifact.

Acceptance

  • Public CLI/MCP produce equivalent identity, event and coverage evidence against an owned JVM fixture.
  • Fixtures cover overloaded methods, two class loaders defining the same name, delayed class preparation, exceptions, and classes compiled without debug tables.
  • Mixed event suspension policies, thread-specific resume, timeout, abrupt VM exit and cancellation do not strand owned suspensions.
  • A side-effecting toString is not called; explicit getter/method invocation is unavailable in this first lane.
  • Provider version, helper identity, event bounds, omitted values and unresolved artifact association remain explicit.
  • One JVM debugging spec and implementation plan are reviewed before integration.

Scope decision

The attach helper is a new provider with runtime effects. CONTRIBUTING.md requires an explicit maintainer decision before substantial implementation for integration. Launch mode, Android forwarding, HotSwap and arbitrary evaluations are separate scope decisions.

Primary references

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2376 [![Type: Architecture / RFC](https://img.shields.io/badge/type-architecture_%2F_RFC-darkred.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Analyst question For an explicitly selected JVM, which class-loader-qualified method and source location was stopped, and what do its threads, frames and available locals show? #1558 covers static Java class analysis. #1267 defines general debugger lifecycle concerns. Neither defines JVM class-loader identity, JDI event suspension or JDWP reference lifetimes. ## Proposed first lane Use a caller-installed JDK/JDI helper to connect to one caller-selected local, already-enabled JDWP endpoint. Verify and retain the available VM/process identity; an endpoint or Java version alone does not prove association with a selected JAR. Discovery must not launch targets, scan ports or enable debugging implicitly. - Select methods by defining class-loader identity, class name and descriptor; preserve overloaded and duplicate-loader classes. - Observe selected line/method/exception events and bounded threads, frames, primitive locals and raw fields. - Distinguish absent line/local tables, pending classes, optimized/unavailable values, collected objects and disconnected VMs. - Retain actual EventSet suspension policy and balance only suspensions owned by this session. Frames expire when their thread resumes. - Render values without toString, getters, expression evaluation, method invocation, class redefinition or field writes. Reading and debugger attachment still have effects and must be declared. - Treat managed locations as VM coordinates, not native addresses or proof that bytes match a static artifact. ## Acceptance - [ ] Public CLI/MCP produce equivalent identity, event and coverage evidence against an owned JVM fixture. - [ ] Fixtures cover overloaded methods, two class loaders defining the same name, delayed class preparation, exceptions, and classes compiled without debug tables. - [ ] Mixed event suspension policies, thread-specific resume, timeout, abrupt VM exit and cancellation do not strand owned suspensions. - [ ] A side-effecting toString is not called; explicit getter/method invocation is unavailable in this first lane. - [ ] Provider version, helper identity, event bounds, omitted values and unresolved artifact association remain explicit. - [ ] One JVM debugging spec and implementation plan are reviewed before integration. ## Scope decision The attach helper is a new provider with runtime effects. CONTRIBUTING.md requires an explicit maintainer decision before substantial implementation for integration. Launch mode, Android forwarding, HotSwap and arbitrary evaluations are separate scope decisions. ## Primary references - [JDI attaching connector](https://docs.oracle.com/en/java/javase/25/docs/api/jdk.jdi/com/sun/jdi/connect/AttachingConnector.html) - [JDI EventSet suspension and resume](https://docs.oracle.com/en/java/javase/26/docs/api/jdk.jdi/com/sun/jdi/event/EventSet.html) - [JDWP identity widths and frame lifetime](https://docs.oracle.com/en/java/javase/25/docs/specs/jdwp/jdwp-spec.html)
Author
Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Design & Protocol Constraints

Objective (ELI5):
Observe target JVM processes via standard JDWP (Java Debug Wire Protocol) socket/transport without introducing arbitrary bytecode mutation.

Core Invariants:

  • Read-only capture: Only issue JDWP commands for thread inspection, stack frames, and object field reads.
  • Do not invoke methods on remote objects (ClassType.InvokeMethod / ObjectReference.InvokeMethod) during frame capture to ensure zero target side effects.
  • Ensure socket disconnection sends proper target resume or clean detachment.
<!-- gh-comment-id:6133920537 --> @matbrgz commented on GitHub (Oct 12, 2026): ### Design & Protocol Constraints **Objective (ELI5):** Observe target JVM processes via standard JDWP (Java Debug Wire Protocol) socket/transport without introducing arbitrary bytecode mutation. **Core Invariants:** - Read-only capture: Only issue JDWP commands for thread inspection, stack frames, and object field reads. - Do not invoke methods on remote objects (`ClassType.InvokeMethod` / `ObjectReference.InvokeMethod`) during frame capture to ensure zero target side effects. - Ensure socket disconnection sends proper target resume or clean detachment.
Author
Owner

@HypergamyDenier commented on GitHub (Oct 13, 2026):

It should be noted too that https://github.com/morluto/rea/issues/1558 contains tools which could be looked into and used as reference for this.

<!-- gh-comment-id:6144277739 --> @HypergamyDenier commented on GitHub (Oct 13, 2026): It should be noted too that https://github.com/morluto/rea/issues/1558 contains tools which could be looked into and used as reference for this.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#787
No description provided.