[GH-ISSUE #2556] fix(browser/cdp-electron): malformed child frame IDs appear as scope exclusions #873

New issue

Closed

opened 2026-10-15 18:29:11 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:29:11 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2556

Summary

Passive Electron page inspection drops a child frame with a numeric or missing ID even when its URL resolves to an eligible local file, then reports that omission as a scope decision. The returned completeness record hides the unavailable frame inventory by listing frames only as policy filtered. This was reproduced through the production provider against a simulated CDP endpoint.

Steps to reproduce

Use the source baseline under Runtime or environment with its locked dependencies installed. Create two regular local HTML files, index.html and child.html. Start the repository fake CDP browser with electronFileUrl set to index.html's file URL and override only Page.getFrameTree with the following response, replacing the file URL markers with those files' actual hostless file URLs.

{
  "frameTree": {
    "frame": { "id": "frame-main", "url": "<index file URL>" },
    "childFrames": [
      { "frame": { "id": 7, "url": "<child file URL>" } }
    ]
  }
}

Call CdpElectronProvider.inspectPage with the fake browser's endpoint, target_id set to electron-page, and observation_ms set to 0. Parse the request with inspectElectronPageInputSchema and inspect the successful result's frames and completeness. Repeat with the child ID omitted, with the child ID set to frame-child, and with that string ID paired with https://example.invalid/child. Close the fake browser and remove the local fixture files after each case. These four cases were executed locally using startFakeCdpBrowser from tests/fixtures/fakeCdpBrowser.ts and the ordinary focused-test runner.

Expected behavior

An invalid or absent child frame identity must remain an explicit protocol limitation. Inspection may retain the valid main frame, but completeness must include frames in unavailable_sections, an invalid_protocol_value exclusion for that child, and attach_limited in conditions. When the child URL is an eligible existing local file, its malformed identity alone must not put frames in policy_filtered_sections. Other policy exclusions may keep the overall status at policy_filtered.

Actual behavior

Both the numeric-ID and missing-ID cases returned only frame-main. Both returned unavailable_sections as an empty array and put frames in policy_filtered_sections with an out_of_target_scope exclusion of count 1. Their conditions contained only policy_filtered. The valid local child control retained frame-child without any frame exclusion. The string-ID remote-URL control correctly recorded a scope exclusion.

Evidence

Expected source: AGENTS.md:19-29 requires preserving identity, uncertainty, and meaningful failure reasons; docs/electron-observation.md:47-50 promises explicit completeness; src/browser/CdpCaptureDocuments.ts:41-45 classifies malformed frame IDs as invalid_protocol_value; src/browser/CdpCaptureCompleteness.ts:23-28,62-67 distinguishes policy omissions from unavailable protocol data.
Failure source: src/browser/CdpElectronInspection.ts:243-251 groups invalid IDs with disallowed file URLs; the focused production-provider replay returned frames as policy filtered for the numeric and absent child IDs.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The focused run executed four cases, with two failing expected-contract assertions and two passing controls. Each malformed-ID case failed with the following output and the focused command exited with code 1.

AssertionError: expected [] to include 'frames'
Test Files  1 failed (1)
Tests  2 failed | 2 passed (4)

The response override reached initial frame authorization because discovery and the main frame both referenced an eligible local file. It reached the child classification because the child tree was an object and its URL resolved successfully; only the identity failed string parsing. This establishes the malformed-response handling failure without claiming that a real Electron version emits malformed IDs. Overall status precedence is defined in src/domain/browserCompleteness.ts:100-115.

Restoration check

Replay both malformed-ID inputs and require an invalid_protocol_value frames exclusion of count 1, frames in unavailable_sections, and attach_limited in conditions. Require frames to be absent from policy_filtered_sections when neither frame URL violates file scope. Preserve the valid-ID local-child control's two retained frames and the string-ID remote-child control's out_of_target_scope exclusion. Do not require the aggregate status to change when other sections remain policy filtered.

Runtime or environment

The failure was verified at repository source revision a2d8b94dd5 and is still present at 8b181716ac, package version 6.4.0, Node v26.10.0, npm 11.19.1, Vitest 5.0.3, macOS arm64. Verification used a simulated loopback HTTP/WebSocket CDP endpoint rather than an installed Electron runtime.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A bounded malformed-response case changes the structured completeness evidence from unavailable protocol data to a deliberate scope exclusion. Consumers cannot identify the frame inventory limitation from unavailable_sections or conditions. The inspection still returns the main frame, and no real-provider incidence or severe workflow failure was established.
Workaround status: unverified
Workaround basis: No practical method to recover the correct omission category from the affected result was demonstrated. Conforming CDP responses avoid the trigger but do not repair the classification of an already affected capture.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2556 ## Summary Passive Electron page inspection drops a child frame with a numeric or missing ID even when its URL resolves to an eligible local file, then reports that omission as a scope decision. The returned completeness record hides the unavailable frame inventory by listing frames only as policy filtered. This was reproduced through the production provider against a simulated CDP endpoint. ## Steps to reproduce Use the source baseline under Runtime or environment with its locked dependencies installed. Create two regular local HTML files, index.html and child.html. Start the repository fake CDP browser with electronFileUrl set to index.html's file URL and override only Page.getFrameTree with the following response, replacing the file URL markers with those files' actual hostless file URLs. ```json { "frameTree": { "frame": { "id": "frame-main", "url": "<index file URL>" }, "childFrames": [ { "frame": { "id": 7, "url": "<child file URL>" } } ] } } ``` Call CdpElectronProvider.inspectPage with the fake browser's endpoint, target_id set to electron-page, and observation_ms set to 0. Parse the request with inspectElectronPageInputSchema and inspect the successful result's frames and completeness. Repeat with the child ID omitted, with the child ID set to frame-child, and with that string ID paired with https://example.invalid/child. Close the fake browser and remove the local fixture files after each case. These four cases were executed locally using startFakeCdpBrowser from tests/fixtures/fakeCdpBrowser.ts and the ordinary focused-test runner. ## Expected behavior An invalid or absent child frame identity must remain an explicit protocol limitation. Inspection may retain the valid main frame, but completeness must include frames in unavailable_sections, an invalid_protocol_value exclusion for that child, and attach_limited in conditions. When the child URL is an eligible existing local file, its malformed identity alone must not put frames in policy_filtered_sections. Other policy exclusions may keep the overall status at policy_filtered. ## Actual behavior Both the numeric-ID and missing-ID cases returned only frame-main. Both returned unavailable_sections as an empty array and put frames in policy_filtered_sections with an out_of_target_scope exclusion of count 1. Their conditions contained only policy_filtered. The valid local child control retained frame-child without any frame exclusion. The string-ID remote-URL control correctly recorded a scope exclusion. ## Evidence - Expected source: AGENTS.md:19-29 requires preserving identity, uncertainty, and meaningful failure reasons; docs/electron-observation.md:47-50 promises explicit completeness; src/browser/CdpCaptureDocuments.ts:41-45 classifies malformed frame IDs as invalid_protocol_value; src/browser/CdpCaptureCompleteness.ts:23-28,62-67 distinguishes policy omissions from unavailable protocol data. - Failure source: src/browser/CdpElectronInspection.ts:243-251 groups invalid IDs with disallowed file URLs; the focused production-provider replay returned frames as policy filtered for the numeric and absent child IDs. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The focused run executed four cases, with two failing expected-contract assertions and two passing controls. Each malformed-ID case failed with the following output and the focused command exited with code 1. ```text AssertionError: expected [] to include 'frames' Test Files 1 failed (1) Tests 2 failed | 2 passed (4) ``` The response override reached initial frame authorization because discovery and the main frame both referenced an eligible local file. It reached the child classification because the child tree was an object and its URL resolved successfully; only the identity failed string parsing. This establishes the malformed-response handling failure without claiming that a real Electron version emits malformed IDs. Overall status precedence is defined in src/domain/browserCompleteness.ts:100-115. ## Restoration check Replay both malformed-ID inputs and require an invalid_protocol_value frames exclusion of count 1, frames in unavailable_sections, and attach_limited in conditions. Require frames to be absent from policy_filtered_sections when neither frame URL violates file scope. Preserve the valid-ID local-child control's two retained frames and the string-ID remote-child control's out_of_target_scope exclusion. Do not require the aggregate status to change when other sections remain policy filtered. ## Runtime or environment The failure was verified at repository source revision a2d8b94dd50dab8d966239dd63ab84718aa8b4b4 and is still present at 8b181716aca2cb467be499cba226abfb5ae19141, package version 6.4.0, Node v26.10.0, npm 11.19.1, Vitest 5.0.3, macOS arm64. Verification used a simulated loopback HTTP/WebSocket CDP endpoint rather than an installed Electron runtime. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A bounded malformed-response case changes the structured completeness evidence from unavailable protocol data to a deliberate scope exclusion. Consumers cannot identify the frame inventory limitation from unavailable_sections or conditions. The inspection still returns the main frame, and no real-provider incidence or severe workflow failure was established. - Workaround status: unverified - Workaround basis: No practical method to recover the correct omission category from the affected result was demonstrated. Conforming CDP responses avoid the trigger but do not repair the classification of an already affected capture.

bsakaguchi

2026-10-15 18:29:11 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:29:12 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in bffdd91053fb5d076b762cf1b325e8dcb5ab2d8c.

Malformed Electron child-frame identities are protocol failures before scope classification.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [bffdd91053fb5d076b762cf1b325e8dcb5ab2d8c](https://github.com/morluto/rea/commit/bffdd91053fb5d076b762cf1b325e8dcb5ab2d8c). Malformed Electron child-frame identities are protocol failures before scope classification. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-16 21:02:34 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:17:05 +00:00

[PR #873] [MERGED] refactor(android): group layered source and verification #2309