[GH-ISSUE #4128] [Bug] Windows package verifier retains CR in tar member names #1626

New issue

Closed

opened 2026-10-16 21:08:09 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:08:09 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4128

After supplying a native npm launcher to get past #4125, the real ordinary-user Windows lane for scripts/verify-packaged-wasm-artifact.mjs packs a complete artifact but verifyPackedBridge reports package omitted package/bridge/hopper_bridge.py.

The tarball does contain that exact member. Windows tar -tf emits CRLF, while scripts/verify-package-pack.mjs uses .stdout.split("\\n") and passes the resulting strings directly to verifyPackedBridge. Each non-final member retains \\r, so exact packedFiles.includes(path) checks fail on Windows.

Reproduced from PR #4117 head ecd04eea840385caeb7b595c827845b6ff8c6c88 on Windows 11 x64 with Node 24.18.0 and npm 11.16.0. The ordinary-user lane used two logical CPUs, BelowNormal priority, and a 2 GiB Job limit. It failed cleanly in 83.98 seconds with 380,555,264-byte peak Job commit and Job active-process count zero. A persistent reproduction of the same npm pack artifact shows package/bridge/hopper_bridge.py in both npm's JSON file inventory and Windows tar -tf output.

Expected behavior: the tar listing owner should parse platform line endings once before consumers compare member identities. Preserve exact member strings beyond line-ending removal, and inspect every consumer of the parsed listing so Windows verification cannot produce false omissions. Add a boundary test that feeds CRLF output and run a real Windows packaged verifier.

Local receipts and the persistent reproduction tarball are retained under /tmp/rea-windows-e2e-20261013/results/issue4109-fix/; no package or binary is published.

Originally created by @N0zoM1z0 on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4128 After supplying a native npm launcher to get past #4125, the real ordinary-user Windows lane for `scripts/verify-packaged-wasm-artifact.mjs` packs a complete artifact but `verifyPackedBridge` reports `package omitted package/bridge/hopper_bridge.py`. The tarball does contain that exact member. Windows `tar -tf` emits CRLF, while `scripts/verify-package-pack.mjs` uses `.stdout.split("\\n")` and passes the resulting strings directly to `verifyPackedBridge`. Each non-final member retains `\\r`, so exact `packedFiles.includes(path)` checks fail on Windows. Reproduced from PR #4117 head `ecd04eea840385caeb7b595c827845b6ff8c6c88` on Windows 11 x64 with Node 24.18.0 and npm 11.16.0. The ordinary-user lane used two logical CPUs, BelowNormal priority, and a 2 GiB Job limit. It failed cleanly in 83.98 seconds with 380,555,264-byte peak Job commit and Job active-process count zero. A persistent reproduction of the same `npm pack` artifact shows `package/bridge/hopper_bridge.py` in both npm's JSON file inventory and Windows `tar -tf` output. Expected behavior: the tar listing owner should parse platform line endings once before consumers compare member identities. Preserve exact member strings beyond line-ending removal, and inspect every consumer of the parsed listing so Windows verification cannot produce false omissions. Add a boundary test that feeds CRLF output and run a real Windows packaged verifier. Local receipts and the persistent reproduction tarball are retained under `/tmp/rea-windows-e2e-20261013/results/issue4109-fix/`; no package or binary is published.

bsakaguchi commented

2026-10-16 21:08:10 +00:00

Author

Owner

@Abdooo2235 commented on GitHub (Oct 15, 2026):

@N0zoM1z0 @morluto I opened #4154 for the tar-listing boundary. The regression reproduces both the false bridge omission and missed .pyc detection with CRLF; all 15 LF/CRLF and member-identity cases pass after the fix, and npm run check passes. The independent npm launcher and private-root extraction fixes remain separate.

@Abdooo2235 commented on GitHub (Oct 15, 2026): @N0zoM1z0 @morluto I opened #4154 for the tar-listing boundary. The regression reproduces both the false bridge omission and missed .pyc detection with CRLF; all 15 LF/CRLF and member-identity cases pass after the fix, and npm run check passes. The independent npm launcher and private-root extraction fixes remain separate.

bsakaguchi closed this issue

2026-10-17 21:02:31 +00:00

bsakaguchi referenced this issue

2026-10-31 00:54:13 +00:00

[PR #1627] [MERGED] fix(onboarding): isolate client homes and clarify npm release support #4710

bsakaguchi referenced this issue

2026-10-31 00:54:16 +00:00

[PR #1637] [MERGED] docs(installation): clarify that npm 6.3.0 excludes automatic pi and hermes setup #4715

bsakaguchi referenced this issue

2026-11-03 21:43:16 +00:00

[GH-ISSUE #1587] [Feature] Improve task-centered REA onboarding and recovery in Codex skills #535