morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2529] fix(frida): later complete script inherits earlier capture truncation #845

New issue

Closed

opened 2026-10-15 18:28:56 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:56 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2529

Summary

Loading a small script into a Frida session whose older script overflowed the capture budget returns the new script's complete messages marked as truncated. The result contains only the new script's messages but uses the session's historical truncation flag, giving the caller an incorrect completeness signal.

Steps to reproduce

Use the tested main revision and the fake Frida provider fixture used by the manager tests. No native target or network connection is required.

Start an attach session with device local and PID 512, using fake lookup and attach calls that succeed.
Load inline script A and confirm its initial small message returns with messagesTruncated: false.
Through A's subscribed message signal, emit 800 messages of type send, each carrying a message value consisting of 32,700 x characters. The session capture now reports truncation.
Configure the fake session's next script load to emit exactly one message carrying { "event": "script-b-complete" }, then load inline script B.
Inspect B's result. Its messages array contains that single intact message value, but its truncation flag is true.

Runtime or environment

Verified at commit 8b181716ac with Node v26.10.0 and npm 11.19.1, installed lockfile dependencies, and simulated Frida handles.

Expected behavior

The truncation flag in a script-load result should describe coverage of that script's returned messages. A fully retained small message from B should not inherit an earlier loss from A. Session status should continue to report the session's historical truncation separately.

Actual behavior

The focused probe observed one fully retained B message with messagesTruncated: true. The session's flag remained true as expected, and A's initial pre-overflow result had reported false. B's message contained its entire synthetic value and no truncation marker.

Evidence

Expected source: AGENTS.md, Tool and Test Changes, requires completeness derived from coverage; src/application/frida/FridaInstrumentationPort.ts:55 defines the script-scoped observation, and src/contracts/fridaToolContracts.ts:57 pairs its messages and truncation flag. src/application/frida/FridaInstrumentationService.ts:441 serializes this result separately from session status.
Failure source: src/frida/FridaInstrumentationManager.ts:400 returns only the newly loaded script's message list, while line 401 returns the session-wide flag. Message eviction at line 853 onward makes that flag sticky. The focused overflow-then-small-load probe returned one intact B message and a true flag.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The focused test passed its assertions for the reproduced mismatch, clean initial-load control, and retained session-wide flag. Real Frida message delivery was not exercised.

Restoration check

Repeat the A overflow followed by B's one small message. B's result should report no truncation while session status still reports the historical loss. A load whose own messages exceed the capture budget must still report truncation, and a clean session with a small load must continue to report no truncation.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A machine-readable evidence-completeness field falsely claims loss in a complete per-script observation after another script overflows. Consumers cannot distinguish actual missing B messages from unrelated session history through this flag.
Workaround status: available
Workaround basis: The clean initial-load control reported no truncation. For an independent B observation, loading B in a clean session avoids inheriting A's historical flag. This workaround does not preserve every persistent multi-script workflow.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2529 ## Summary Loading a small script into a Frida session whose older script overflowed the capture budget returns the new script's complete messages marked as truncated. The result contains only the new script's messages but uses the session's historical truncation flag, giving the caller an incorrect completeness signal. ## Steps to reproduce Use the tested main revision and the fake Frida provider fixture used by the manager tests. No native target or network connection is required. 1. Start an attach session with device `local` and PID 512, using fake lookup and attach calls that succeed. 2. Load inline script A and confirm its initial small message returns with `messagesTruncated: false`. 3. Through A's subscribed message signal, emit 800 messages of type `send`, each carrying a message value consisting of 32,700 `x` characters. The session capture now reports truncation. 4. Configure the fake session's next script load to emit exactly one message carrying `{ "event": "script-b-complete" }`, then load inline script B. 5. Inspect B's result. Its messages array contains that single intact message value, but its truncation flag is true. ## Runtime or environment Verified at commit 8b181716aca2cb467be499cba226abfb5ae19141 with Node v26.10.0 and npm 11.19.1, installed lockfile dependencies, and simulated Frida handles. ## Expected behavior The truncation flag in a script-load result should describe coverage of that script's returned messages. A fully retained small message from B should not inherit an earlier loss from A. Session status should continue to report the session's historical truncation separately. ## Actual behavior The focused probe observed one fully retained B message with `messagesTruncated: true`. The session's flag remained true as expected, and A's initial pre-overflow result had reported false. B's message contained its entire synthetic value and no truncation marker. ## Evidence - Expected source: `AGENTS.md`, Tool and Test Changes, requires completeness derived from coverage; `src/application/frida/FridaInstrumentationPort.ts:55` defines the script-scoped observation, and `src/contracts/fridaToolContracts.ts:57` pairs its messages and truncation flag. `src/application/frida/FridaInstrumentationService.ts:441` serializes this result separately from session status. - Failure source: `src/frida/FridaInstrumentationManager.ts:400` returns only the newly loaded script's message list, while line 401 returns the session-wide flag. Message eviction at line 853 onward makes that flag sticky. The focused overflow-then-small-load probe returned one intact B message and a true flag. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The focused test passed its assertions for the reproduced mismatch, clean initial-load control, and retained session-wide flag. Real Frida message delivery was not exercised. ## Restoration check Repeat the A overflow followed by B's one small message. B's result should report no truncation while session status still reports the historical loss. A load whose own messages exceed the capture budget must still report truncation, and a clean session with a small load must continue to report no truncation. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A machine-readable evidence-completeness field falsely claims loss in a complete per-script observation after another script overflows. Consumers cannot distinguish actual missing B messages from unrelated session history through this flag. - Workaround status: available - Workaround basis: The clean initial-load control reported no truncation. For an independent B observation, loading B in a clean session avoids inheriting A's historical flag. This workaround does not preserve every persistent multi-script workflow.

bsakaguchi

2026-10-15 18:28:56 +00:00

closed this issue
added the
area: native

bug
labels

bsakaguchi commented

2026-10-15 18:28:57 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in 5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4.

Capture truncation is tracked per retained script as well as for the session; a complete later script no longer inherits another script's loss.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4](https://github.com/morluto/rea/commit/5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4). Capture truncation is tracked per retained script as well as for the session; a complete later script no longer inherits another script's loss. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-16 21:16:43 +00:00

[PR #845] [MERGED] refactor: compose investigation record ownership #2283

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#845

No description provided.

Rows
Columns