Replay ranks a record whose path segment equals the argument as written
above one that matches only after percent-decoding, so two recorded
spellings that decode alike no longer resolve by manifest order.
The /agentenv data plane answers -32600 for an id that is not a string,
number or null and for params that are not an object or array, and
refuses a batch of more than 100 messages before building any reply.
The environment MCP server now extends RequestTrackingMcpServer, which
the HTTP owner requires since the streamable-HTTP change it builds on.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Classify loopback from the actual bound IP only, then add the configured name to the Host/Origin allowlist. Remove DNS-name classification and the default/fallback that substituted configuration for binding evidence.
Validate the TCP address once before URL/allowlist consumers, preserve IPv4 and IPv6 alias behavior, and add negative controls for localhost names bound to non-loopback IPv4 and IPv6 addresses.
Make the web-response writer own one reader and one cancellation operation across headers, pumping and completion, so every output exception retains source cleanup before provider teardown. The pump borrows that ownership instead of releasing the source on its own.
Reject raw fragment delimiters before parsing origin-form request targets, preserving percent-encoded query data. Add real HTTP negative controls for malformed chunks, invalid output headers and query fragments.
Own complete node HTTP exchanges and separately join response-source cancellation before provider hooks. Retain plain-response admission through asynchronous cleanup, preserve prompt HEAD delivery and MCP SSE admission, and fail closed on unsuccessful cleanup.
Reject queued pipelined requests before allocating work or buffered refusals, keep sequential keep-alive, and withhold all routes until server construction succeeds. Add real HTTP regressions for cancellation, late responses, tee ownership, cleanup failures, resource capacity, pipelining and keep-alive.
Push optional native symbol selection into GNU objdump before collecting Evidence. Preserve native matching, raw output, artifact identity, scoped limitations and the existing full-disassembly default through the shared CLI/MCP workflow.
Fixes#5159
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Track admitted route dispatches until their finalizers settle, retain admission while uploads remain unfinished, and separate MCP cancellation from provider hooks. Reuse staged transport cleanup for startup failures and normal shutdown. Cover plain-route cleanup, incomplete streaming uploads and pending-factory failure with real HTTP requests.
Keep a run-scoped evidence owner from acquisition through settlement and
cleanup retry. Bind token observations to native generations and retain
related generations and unresolved identity lookups across table omissions,
reparenting and process-group changes without treating PID hints as authority.
Use native effective UID facts for withholding decisions, corroborate Linux
procfs absence, and share the Linux stat parser with sampling and debugger
identity checks. Signal only after current token and group revalidation.
Complete swept cleanup across all groups with one bounded final family check;
retain unresolved owners and successful-peer completion across retries.
Validation: npm run check, docs:check and test discovery passed. Focused
ownership/consumer coverage totals 513 passed and 1 skipped across 35 files,
including the corrected Electron cancellation test rerun independently. Darwin helper compilation, real
owned Node child cleanup, CLI/MCP capture and retained cleanup retries ran.
Real Electron applications, native Linux races/PID reuse and Windows cleanup
were not qualified. The original Linux reports remain open for that work.
Fixes#5238
Refs #4322, #5206
Attempt independent auth and run-tree cleanup even after permission denial,
retaining the primary verification failure alongside cleanup errors. Exercise
both retention modes through the verifier entrypoint, preserve startup
diagnostics, and retain cooperative coverage for root.
Fixes#5095
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
Admit a bounded number of HTTP input dispatches before constructing requests or initialize tees. Release permits after dispatch and cancel each body forwarder when SDK processing ends. Preserve HTTP reply ownership by pausing cancelled incoming bodies and retaining native stream completion monitoring. Cover overload recovery, early SDK refusals and real unfinished uploads.
* fix(tests): restore reliable snapshot and container CI checks
Keep exact cancellation causes and partial snapshot facts in regression oracles. Match fault injection to real directory handles and isolated MCP module ownership; await terminal cleanup progress within the existing test deadline. Reuse the valid ASAR Pickle fixture and preserve truncated-container rejection.
* fix(tests): isolate runtime faults and own CLI subprocesses
Keep the runtime provider mock in the isolated project after reused CLI graphs exposed lost fault injection. Use the existing owned CLI fixture for Inspector parity and update command checks, retain caller environment choices, and require the removed alias to fail with COMMAND_NOT_FOUND. Keep current test deadlines and production behavior.
* fix(process): retain executable handles through read cancellation
Use the existing borrowed descriptor reader so stream cancellation cannot invalidate a handle owned by capture. Preserve the exact cancellation and permit immediate scope reuse after cleanup. Reproduce the native-stream failure with actual file IO and retain completed/failed-close controls.
Synchronize runtime cancellation and backwards-clock injection with observed running progress. The corrected clock oracle now rejects a Date.now-based deadline under controlled rollback; keep test deadlines and narrow host cleanup checks unchanged.
* test(process): observe prelaunch cancellation at descriptor reads
* fix(process): retain read failures alongside observed cancellation
* fix(flutter): advertise portable Unicode ABI selectors
Own HTTP request parsing and dispatch before SDK awaits. Fence closed-session messages, abort pending body reads and cancel stale response streams before releasing shared resources. DELETE remains outside its own drain. Cover late bodies and sampled public SDK dispatch orderings while preserving stdio behavior.
Reuse canonical CLI fields and preserve literal archive labels through exact selection. Keep UTF-8 path budgets at inventory while advertising the same bounded Unicode selector that runtime admission enforces.
Co-authored-by: Yi-111-a <153097222+Yi-111-a@users.noreply.github.com>
Scan provider output before retention and keep bounded confirmed token facts
through output completion. Exclude identifier prefixes, pre-checkpoint context,
and unconfirmed tails; preserve invalid UTF-8 and directional truncation facts.
Make confirmed OOME observations authoritative for projection. Retained raw
prefixes cannot establish an OOME, and unrelated output cannot supply its
resource kind or recovery advice. Incomplete no-OOME output preserves the
primary error and explains uncertainty. Current checkpoint coverage remains
separate from historical budget loss.
Adapt the retention approach from #4774 with independently reproduced scanner
and projection counterexamples corrected before integration.
Validation: 268 focused tests, npm run check, npm run docs:check, and test
discovery (1639 files exactly once) pass. Controlled Node pipes/socket and fake
Ghidra JVM only; real Ghidra and native Linux/Windows behavior are unverified.
Fixes#4682Fixes#5220
Co-authored-by: reason-machines[bot] <293529679+reason-machines[bot]@users.noreply.github.com>
Co-authored-by: Saim Shafique <msaimshafique4664@gmail.com>
Keep per-script messages and truncation in one owned capture through native
load completion and awaited cleanup. Return cancelled partial observations
when cancellation is observed at native completion, including native rejection;
retain failed cleanup for retry and preserve earlier failures during cleanup.
Report missing creation handles without claiming the engine did no work.
Hash original script-file bytes and retain replacement-decoding provenance
without changing normalized CLI/MCP result schemas or accepted file behavior.
Share this projection across persistent and one-shot Evidence.
Validation: 103 focused tests, final 38 manager source tests, npm run check,
and npm run docs:check pass. Controlled public CLI/MCP workflows and fake
Frida bindings only; no real target injection or device verification.
Fixes#3979Fixes#3396
Supervise sampler and ownership-query commands through physical exit on
cancellation. Share Darwin helper command ownership, reject new commands
after close starts, and drain admitted commands before removing the root.
Keep failed root cleanup retryable without rerunning completed queries.
Fixes#5199Fixes#5202
Keep procfs absence separate from denied and failed reads. Carry successful
rows, thread children and bounded diagnostics together so one failed sibling
cannot erase readable peers. Retain root initialization failures and validate
ps-discovered Linux candidates through stable procfs identity brackets.
Await issued reads during shutdown, retain completed rows and report an
unfinished pass through the existing sampling failure/diagnostic contract.
Derive partial coverage at its owner and preserve actual read errors when
shutdown also interrupts observation. Keep the public capture schema unchanged
and verify it with the previous strict capture reader.
Update directly affected coverage consumers and regression fixtures, including
identity contradictions, mixed outcomes, late failures, cleanup, cancellation,
process-only comparison unknowns and converted MCP schemas.
Validation: 12 focused files / 123 tests; full check; docs check (5 tests);
test discovery (1,635 files). Real macOS CLI/MCP controls exercised source-owned
PTY targets. Linux permission behavior uses deterministic boundary fixtures;
real Linux and Windows qualification remain unavailable. Completed CLI cost
comparisons do not establish a speedup.
Fixes#5081Fixes#5194
Run inert captured-script analysis in owned children with per-script and aggregate deadlines, bounded source/result transfer and explicit per-script coverage. Preserve completed facts and exact cleanup authority across cancellation, mixed descriptor/process failures and cross-consumer retry.
Share aggregate source admission across page and Electron capture, expose CLI/MCP resource controls and retain selected parameters in Evidence. Verified with controlled CDP public workflows, real owned Node failure controls and the reporter-matching ReactDOM UMD artifact; real Chrome/Electron and Windows/Bun remain unqualified.
Replace initializer-history and full-path enumeration with a finite projection
join at each source read. Retain conservative local returned-reference effects
and disclose precision loss through static, semantic and captured-web results.
Close full-binding callback cycles while preserving narrowed read semantics.
Fixes#4348Fixes#5138
Refs #4349
Refs #4364
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Fuxuan-CN <3072252442@qq.com>
- The data plane treated a batch or a notification as one call and
replied to everything. Notifications now get 202 with no body, a batch
gets one reply per request in it, and an empty batch or a message that
is not a JSON-RPC request gets -32600 invalid request.
- The replay limit applied to a base64 body's spelling, so a binary body
under 256 KiB was truncated because its base64 is a third longer. The
limit now applies to the recorded bytes, and a cut keeps whole base64
groups.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A transport wrapper marks every tools/call result as target content,
including the argument errors the SDK returns before a replay runs.
- The server's instructions add that tool names, descriptions, parameter
names and observed values come from the capture too, so the catalog is
treated as data like the replies.
- Strict UTF-8 decoding keeps a leading byte-order mark instead of
dropping it from the recorded text.
- A large retained base64 body is decoded only as far as the 256 KiB a
reply can carry, and the replay reports it truncated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each attempt had its own 15-minute timeout, so a quota retry could
outlast the 30-minute job before the failed receipt was written. Both
attempts now share a 22-minute budget and the retry runs only with five
minutes to spare. The container inventory ran only after a successful
run; it now runs in finally, so a failed or timed-out receipt still lists
what the run left behind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The Dockerfile copies manifest.json and evidence.json owned by the node
user, so a private host umask cannot leave the runtime user unable to
read them.
- The generated verifier keeps the first record's own unknown status
instead of borrowing another record's, and an error reply never passes
the check, even when the recorded status is unknown.
- Export checks, before reading an input, that reading and natively
parsing the whole file fits live heap headroom, with the same rule the
bounded JSON reader applies to native parsing, and refuses it as a
resource constraint otherwise.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The replay MCP server serves names, descriptions and replies taken from a
captured application but advertised no instructions, so clients that
rely on server instructions had no warning not to follow target text. It
now carries the same untrusted-content instructions as REA's own server,
moved next to the target-content result marker so both import it.
Retained HAR base64 bodies were decoded as UTF-8 even when the bytes were
not UTF-8, inventing replacement characters. They are now decoded
strictly; other bytes are returned exactly as base64 with
body_encoding: "base64".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Path parameters, query parameters and the write body share one argument
object, so a query named like a path parameter or 'body' could not be
supplied, and query names such as 'constructor' were dropped as already
taken. One argument map, used by both the schema and the replay scorer,
now renames a colliding query to query_<name> and a colliding body to
request_body, and is built without inherited keys. Replay results gain
body_recorded, so a body the capture did not keep is not passed off as a
recorded null, and truncation encodes only the 256 KiB prefix instead of
the whole body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Carry historical cleanup reports with the exact lease that can confirm
release. Bind originating capture errors and typed retry aggregates to
those owners while preserving primary failures and completed observations.
Keep those bindings through MCP close and compose mixed session/process
cleanup failures. Start both close operations even when a child throws a
typed failure synchronously.
Fixes#5144Fixes#5163Fixes#5166
Hosted runners share that registry's quota, and the framework builds its
infra images from it on every fresh runner; a 429 from it earns one retry
after 90 seconds, recorded in the receipt, while any other failure ends the
lane at once.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The pattern was a `const` below the top-level try block, so the leak filter
reached it in the temporal dead zone the first time a run actually created
the helper; locally no container was new, so the filter never ran. Reproduced
the fresh-host path by removing the local `agentenv-registry` before a run.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add rea environment-serve <manifest.json> --evidence <capture.json>
[--host] [--port]: it loads an environment-manifest view and the capture
Evidence it was projected from, refuses a manifest whose parent evidence id
does not match the capture, builds one MCP tool per manifest tool and serves
them over streamable HTTP beside an environment card at
/.well-known/agent-env.json and a data plane at /agentenv that refuses every
method. Each tool call replays the retained record whose path and query
values best match the arguments, cites the record ordinal and evidence id,
marks replayed content as untrusted target content, and truncates bodies
over 256 KiB with a flag. Nothing executes the captured application.
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The first hosted run of the real-agentenv lane failed only on the cleanup
check: agent-env's local image store starts a registry:2 helper
(`agentenv-registry[-<port>]`) on first use and keeps it running across runs,
so a fresh runner ends the run with one more container than it started with.
The verifier now lists containers with their names, reports that helper under
`image_store_helpers` and asserts that nothing else was added.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add rea environment-export <manifest.json> --evidence <capture.json> <dir>
[--package-tarball <path>] [--name <override>]: it reads and authenticates the
manifest and capture pair once and writes an agent environment bundle folder
(README with provenance and a rights note, envs/<name> with a Dockerfile that
pins this exact rea version or installs a given tarball, the manifest and the
Evidence as byte-identical copies, a Python verifier that checks replay
through the MCP endpoint, and a smoke task) that the agentenv framework runs
with agent-env run. Refuses a non-empty directory and a mismatched pair
before writing. Adds the real-agentenv hosted lane, which packs the checkout,
exports a bundle from the source-owned capture fixture and runs it on the
runner's Docker with a pinned agentenv-framework, wired into the CI planner
and its guard tests.
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Keep canonical callback ownership independent of writable raw-listener
metadata. Resolve the native removal argument in current registration order,
then let EventEmitter own mutation, getter timing and removal meta-events.
Leave registrations unwrapped with explicit observation gaps when methods
or receivers do not support that ownership model. Preserve per-callback
Evidence for supported registrations and document the remaining limits.
Fixes#4513
Derive address suggestions separately from name uniqueness across every
validated inventory row. Keep the sole exact address or an explicit ambiguous
state per name, without retaining a set of all name/address pairs. Reuse the
canonical address/value leaf contract for completion's parsed facts.
Cover order independence, same-address duplicates, later ambiguity and alias
rows beyond the MCP reply limit through the public SDK. Preserve provider
spelling, document context, cold-session admission and cancellation behavior.
Adapted from #4648 at 5b019e1179.
Closes#4623
Co-authored-by: shreyansh1729 <shreyanshiitian1729@gmail.com>
Edgar Arakelyan