mirror of
https://github.com/morluto/rea
synced 2026-10-28 15:07:26 -04:00
fix(reverse): reconcile cleanup ownership and mutation diagnostics (#2799)
* feat(process): add owned debugger shutdown lifecycle * feat(reverse): add local inspection commands * feat(gdb): add persistent debugger integration * feat(cutter): add Cutter bridge integration * test(reverse): enforce complete integration coverage * fix(process): preserve debugger shutdown ownership * fix(reverse): retain evidence across interrupted commands * fix(gdb): honor captured provider environment * test(process): cover debugger shutdown retries * fix(reverse): retain evidence for interrupted providers * test(process): cover debugger shutdown retries * fix(reverse): retain evidence for interrupted providers * fix(server): snapshot provider environment at creation * fix(reverse): close review gaps with complete coverage * fix(reverse): address inspection review findings * fix(gdb): bound sessions and retain cleanup ownership * fix(ci): require reverse-tools quality lane * fix(process): unref inherited debugger output pipes * fix(reverse): address remaining PR 1960 findings * fix(gdb): address remaining PR 1961 findings * fix(reverse): account for unrestricted provider execution * fix(process): retain debugger ownership until safe shutdown * fix(process): preserve replacement debugger sessions * fix(reverse): preserve admission and output provenance * fix(process): retain exited debugger until output settles * fix(mcp): bound provider admission and debugger cleanup * fix(reverse): preserve failure provenance and classify E2BIG * fix(gdb): preserve startup cleanup and detach safety * fix(process): retain debugger ownership after detach failure * fix(reverse): preserve mutation and failure provenance * fix(gdb): address debugger review findings * fix(reverse): rebind sessions after external mutation * fix(process): cap debugger output after exit * fix(gdb): protect one-shot detach verification * feat(debugger): add reverse tool coverage gate * test(debugger): cover integrated failure paths * fix(gdb): bound and preserve session observations * fix(gdb): address review regressions * style: format merged integration files * fix(reverse): preserve session and output evidence * refactor(gdb): share repeated test and partial result setup * fix(gdb): invalidate TTY proof for Python aliases * fix(reverse): retain failure output byte counts * test(process): synchronize late debugger output * fix(gdb): invalidate TTY proof for wrapped commands * fix(gdb): recognize wit command abbreviation * test(reverse): wait for cancelled descendant readiness * test(reverse): bound descendant cancellation cleanup * style(reverse): format integration tests and adapters * style: format reverse engineering integration files * test(reverse): remove duplicate environment harness * test(gdb): share session startup assertions * fix(gdb): invalidate output proof for command abbreviations * test(reverse): share composition edge case scenarios * fix(ci): recognize verification and mutation tool entries * test(rizin): cover successful fake inferior detach * test(cli): align full output failure envelope * test(cli): isolate reverse command lifecycle service * test(process): share debugger output fixture setup * fix(binary): preserve high-bit Windows signature bytes * style(binary): format Windows signature parser * test(mcp): preserve call coverage in unchanged comparison * fix(ci): include reverse tools Vitest configs in lint cache * fix(mcp): preserve target content on delivery errors * ci: align duplication ceiling with expanded suite * test(reverse): allow signal admission mutants * fix(reverse): bound retained cleanup failures to process owners * fix(test): replace drifting mutation ranges with owned selectors * fix(reverse): admit persistent commands and retain cleanup ownership * fix(cutter): recover timed-out commands from exact receipts * fix(cutter): reject unsupported bridge request kinds * fix(ci): repair client format and shared verification fixtures * fix(native): preserve debugger cleanup ownership and bridge authentication * test(native): retain diagnostics without perfect coverage requirements * chore(licenses): refresh locked dependency inventory and notices * fix(test): exclude transient command locks from mutation sandboxes * fix(gdb): admit only platforms with safe detach verification * fix(cutter): retain bounded completion receipts until acknowledgement * fix(cutter): acknowledge commands rejected before UI dispatch * test(reverse): fail cancellation checks before fixture teardown * test(gdb): clean up the retained broken-stdin fixture owner * docs(test): clarify focused provider verification scope * fix(rizin): retain close cleanup failures * fix(gdb): wait for inferior stop and bound MI buffering * fix(cutter): retain failed receipt acknowledgements * fix(rizin): return retained session identity on rebind failure * fix(gdb): preserve startup cancellation and lossy status * fix(rizin): retain launch provenance and assemble frames once * fix(cutter): recover receipts across callers and bound discovery * docs: describe debugger evidence and bridge recovery * fix(process): keep cleanup incomplete while writers remain Stopping a debugger no longer reports success when inherited output streams stay open, so BinarySession cannot reopen a binary a child is still changing. Concurrent Cutter cleanup retries share one receipt acknowledgement instead of treating a consumed receipt as failure. * fix(debuggers): recover cleanup with captured process identities * fix(analysis): retire sessions after unrestricted commands * fix(cli): preserve completed evidence after cleanup recovery * fix(cutter): bound frame collection and coalesce cleanup * fix(windows): resolve selected provider paths absolutely * fix(gdb): report decoding loss in failed startup evidence * fix(rizin): scope decoding loss to collected command frames * test(mcp): cover snapshot retirement in reverse tools CI --------- Co-authored-by: Daniel Gonçalves Araujo <47118053+dandgabr@users.noreply.github.com> Co-authored-by: REA Maintainers <noreply@github.com> Co-authored-by: OpenAI Codex <codex@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
This commit is contained in:
morluto
@@ -6,10 +6,14 @@ import { WindowsOwnedProcess } from "../windows/WindowsOwnedProcess.js";
|
||||
|
||||
import type {
|
||||
OwnedProcessGroup,
|
||||
ProcessOwnershipBaseline,
|
||||
ProcessCleanupFailure,
|
||||
ProcessCleanupResult,
|
||||
} from "./ProcessOwnership.js";
|
||||
import { prepareProcessOwnershipInspection } from "./ProcessOwnershipObservation.js";
|
||||
import {
|
||||
prepareProcessOwnershipInspection,
|
||||
systemProcessOwnershipHost,
|
||||
} from "./ProcessOwnershipObservation.js";
|
||||
|
||||
const DEFAULT_TERMINATION_GRACE_MS = 250;
|
||||
const DEFAULT_KILL_GRACE_MS = 1_000;
|
||||
@@ -36,6 +40,8 @@ export interface OwnedProviderProcessSpawnOptions {
|
||||
* Windows Job Object. Other launchers cannot enforce it and refuse it.
|
||||
*/
|
||||
readonly memoryLimitBytes?: number;
|
||||
/** Sweep exact run-token descendants during POSIX cleanup. */
|
||||
readonly sweepTokenOwnedProcesses?: boolean;
|
||||
/** Cancels native ownership preparation before provider process creation. */
|
||||
readonly signal?: AbortSignal;
|
||||
}
|
||||
@@ -95,6 +101,8 @@ export interface ProviderProcessSnapshot {
|
||||
readonly diagnosticTruncated?: boolean;
|
||||
readonly stdout: {
|
||||
readonly text: string;
|
||||
/** True when retained bytes cannot be represented exactly as UTF-8 text. */
|
||||
readonly invalidUtf8?: true;
|
||||
/** Bytes retained in text, limited by maxDiagnosticBytes when configured. */
|
||||
readonly bytes: number;
|
||||
/** All bytes drained from this stream since construction or resetOutput. */
|
||||
@@ -102,6 +110,8 @@ export interface ProviderProcessSnapshot {
|
||||
};
|
||||
readonly stderr: {
|
||||
readonly text: string;
|
||||
/** True when retained bytes cannot be represented exactly as UTF-8 text. */
|
||||
readonly invalidUtf8?: true;
|
||||
/** Bytes retained in text, limited by maxDiagnosticBytes when configured. */
|
||||
readonly bytes: number;
|
||||
readonly observedBytes: number;
|
||||
@@ -174,6 +184,16 @@ export const spawnOwnedProviderProcess = async (
|
||||
await prepareProcessOwnershipInspection(options.signal);
|
||||
options.signal?.throwIfAborted();
|
||||
const platform = options.platform ?? process.platform;
|
||||
const sweepTokenOwnedProcesses =
|
||||
options.sweepTokenOwnedProcesses === true && platform !== "win32";
|
||||
let captureBaseline: ProcessOwnershipBaseline | undefined;
|
||||
if (sweepTokenOwnedProcesses) {
|
||||
const capture = systemProcessOwnershipHost.captureBaseline;
|
||||
if (capture === undefined)
|
||||
throw new Error("Process ownership baseline is unavailable on this host");
|
||||
captureBaseline = await capture(options.signal);
|
||||
options.signal?.throwIfAborted();
|
||||
}
|
||||
const hostEnvironment = options.hostEnvironment ?? process.env;
|
||||
const environment = {
|
||||
...hostEnvironment,
|
||||
@@ -226,6 +246,12 @@ export const spawnOwnedProviderProcess = async (
|
||||
leaderPid: pid,
|
||||
processGroupId: pid,
|
||||
expectedParentPid: process.pid,
|
||||
...(sweepTokenOwnedProcesses
|
||||
? {
|
||||
sweepTokenOwnedProcesses: true,
|
||||
captureBaseline: captureBaseline!,
|
||||
}
|
||||
: {}),
|
||||
...(options.expectedCommand === null
|
||||
? {}
|
||||
: { expectedCommand: options.expectedCommand ?? options.command }),
|
||||
@@ -282,12 +308,14 @@ export class ProviderProcessSupervisor {
|
||||
#exitObservation: ProviderProcessExitObservation | undefined;
|
||||
#stopPromise: Promise<ProviderProcessStopResult> | undefined;
|
||||
#disposed = false;
|
||||
#maxDiagnosticBytes: number | undefined;
|
||||
|
||||
constructor(
|
||||
readonly launch: ProviderProcessLaunch,
|
||||
options: ProviderProcessSupervisorOptions = {},
|
||||
) {
|
||||
this.#options = options;
|
||||
this.#maxDiagnosticBytes = options.maxDiagnosticBytes;
|
||||
if (options.captureStdout !== false)
|
||||
this.#attach(launch.process.stdout, "stdout");
|
||||
this.#attach(launch.process.stderr, "stderr");
|
||||
@@ -340,7 +368,7 @@ export class ProviderProcessSupervisor {
|
||||
);
|
||||
}
|
||||
|
||||
/** Wait until the producer has closed its output streams; exit alone does not prove complete output. */
|
||||
/** Wait until output streams close; WindowsOwnedProcess closes only after its whole Job Object settles. */
|
||||
async waitForOutputClose(timeoutMs: number): Promise<boolean> {
|
||||
return waitForProcessEvent(
|
||||
this.#outputClosed,
|
||||
@@ -349,6 +377,35 @@ export class ProviderProcessSupervisor {
|
||||
);
|
||||
}
|
||||
|
||||
/** Bound additional retained bytes while still draining all later output. */
|
||||
limitAdditionalOutputBytes(maxBytes: number): void {
|
||||
if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
|
||||
throw new RangeError(
|
||||
"Additional output limit must be a non-negative safe integer.",
|
||||
);
|
||||
const retained = this.#stdout.bytes + this.#stderr.bytes;
|
||||
const requestedLimit = Math.min(
|
||||
Number.MAX_SAFE_INTEGER,
|
||||
retained + maxBytes,
|
||||
);
|
||||
this.#maxDiagnosticBytes =
|
||||
this.#maxDiagnosticBytes === undefined
|
||||
? requestedLimit
|
||||
: Math.min(this.#maxDiagnosticBytes, requestedLimit);
|
||||
}
|
||||
|
||||
/** Unreference inherited output pipes without closing streams shared with descendants. */
|
||||
unrefOutputStreams(): void {
|
||||
for (const stream of [
|
||||
this.launch.process.stdout,
|
||||
this.launch.process.stderr,
|
||||
]) {
|
||||
const unref = (stream as (Readable & { unref?: () => void }) | null)
|
||||
?.unref;
|
||||
unref?.call(stream);
|
||||
}
|
||||
}
|
||||
|
||||
/** Share each stop attempt; incomplete cleanup retains ownership and permits retry. */
|
||||
stop(
|
||||
options: ProviderProcessStopOptions = {},
|
||||
@@ -509,13 +566,11 @@ export class ProviderProcessSupervisor {
|
||||
if (stream === "stdout") this.#stdoutObservedBytes += bytes.byteLength;
|
||||
else this.#stderrObservedBytes += bytes.byteLength;
|
||||
const remaining =
|
||||
this.#options.maxDiagnosticBytes === undefined
|
||||
this.#maxDiagnosticBytes === undefined
|
||||
? bytes.byteLength
|
||||
: Math.max(
|
||||
0,
|
||||
this.#options.maxDiagnosticBytes -
|
||||
this.#stdout.bytes -
|
||||
this.#stderr.bytes,
|
||||
this.#maxDiagnosticBytes - this.#stdout.bytes - this.#stderr.bytes,
|
||||
);
|
||||
const retained = Math.min(bytes.byteLength, remaining);
|
||||
if (retained < bytes.byteLength) this.#diagnosticTruncated = true;
|
||||
@@ -564,11 +619,19 @@ class ProcessOutputCapture {
|
||||
}
|
||||
|
||||
snapshot(observedBytes: number): ProviderProcessSnapshot["stdout"] {
|
||||
const text = Buffer.concat(this.#chunks, this.#bytes).toString("utf8");
|
||||
const buffer = Buffer.concat(this.#chunks, this.#bytes);
|
||||
const text = buffer.toString("utf8");
|
||||
let invalidUtf8 = false;
|
||||
try {
|
||||
new TextDecoder("utf-8", { fatal: true }).decode(buffer);
|
||||
} catch {
|
||||
invalidUtf8 = true;
|
||||
}
|
||||
return {
|
||||
text,
|
||||
bytes: this.#bytes,
|
||||
observedBytes,
|
||||
...(invalidUtf8 ? { invalidUtf8: true } : {}),
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user